| Package | Affected versions | Patched versions |
|---|---|---|
| pulp | ≤ 2.8.2-1 |
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free